ThreatFox: DarkTortilla IOCs

Hunt Hypothesis

This hunt targets the presence of DarkTortilla IOCs to identify potential compromise by this threat actor, which is known for deploying web shells and establishing persistent access in cloud environments. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect early-stage intrusion attempts and mitigate the risk of lateral movement or data exfiltration before the adversary achieves their objectives.

IOC Summary

Malware Family: DarkTortilla Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`6440053c62f579c2dfd9935f535ba15cd326b17e`	payload	2026-09-21	95%
md5_hash	`04f5fdfac670ae1f057a4ce8e494cea1`	payload	2026-09-21	95%
sha256_hash	`f9b214dcc50723e8f35a8f18cd4324065b481107f8c2bec6aa4a127156f8ccab`	payload	2026-09-21	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - DarkTortilla
let malicious_hashes = dynamic(["6440053c62f579c2dfd9935f535ba15cd326b17e", "04f5fdfac670ae1f057a4ce8e494cea1", "f9b214dcc50723e8f35a8f18cd4324065b481107f8c2bec6aa4a127156f8ccab"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — DarkTortilla

False Positive Guidance

Scenario: A DevOps team uses curl or wget to download a specific configuration bundle or script from a trusted internal mirror that happens to share the same IP address or domain hash as one of the DarkTortilla IOCs (e.g., a shared CDN or public S3 bucket).
- Filter/Exclusion: Exclude alerts where the source IP is within the corporate RFC1918 range (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or where the user agent string contains known internal tool identifiers (e.g., ansible, terraform, kubernetes).
Scenario: A security engineer or threat hunter manually executes a YARA rule or a Python script to validate the presence of DarkTortilla IOCs on a staging server, triggering the hunt package during a scheduled maintenance window.
- Filter/Exclusion: Exclude events where the process name is python.exe, yara.exe, or powershell.exe and the command line contains keywords like -scan, hunt, or validate, or where the account belongs to the SecurityOps or ThreatHunt service group.
Scenario: A legacy application or backup agent (e.g., Veeam, Commvault) connects to a public endpoint for license validation or cloud sync that coincidentally matches a DarkTortilla domain or IP due to shared infrastructure or DNS round-robin.
- Filter/Exclusion: Exclude alerts where the process name is a known backup or management agent (e.g., veeam.exe, commvault.exe, nagios.exe) and the destination port is 443 or 80, provided the source account is a dedicated service account (e